Dependency had malicious-release incident (last 90d)
A fork / dependency lineage factor in the v1.7.0 rubric. Measured per protocol on a e cadence.
Methodology how we score#
What this measures
This factor monitors whether any npm, PyPI, or crates.io dependency used by the protocol has had a flagged malicious release incident in the trailing 90 days. The assessment runs on an episodic, event-driven cadence by cross-referencing the protocol's public dependency list against security advisory feeds (npm advisories, OSV database, GitHub Security Advisories). A flag is recorded if any protocol dependency appears in a confirmed supply-chain compromise report within the 90-day window.
Why it matters
Supply-chain attacks on DeFi tooling dependencies are an emerging and undermonitored risk vector. If a protocol's deployment scripts, testing infrastructure, or build tools depend on a compromised package, a malicious actor could inject code that modifies the deployment artifact, exfiltrates private keys used in the deployment process, or corrupts test results to hide a vulnerability. While approximately two directly linked instances exist in the T-01 inventory, the supply-chain attack surface is growing as DeFi protocols use increasingly complex build pipelines with many transitive dependencies.
Green / Yellow / Red
Green: no dependencies in the protocol's public dependency list have appeared in any supply-chain compromise advisory in the trailing 90 days. Yellow: a dependency had a flagged advisory but only for versions the protocol does not use, confirmed by the pinned version check. Red: a dependency used by the protocol at its currently pinned version is under an active supply-chain compromise advisory.
Common gray cases
This factor is gray when the protocol does not maintain a public repository and the dependency list cannot be assessed, or when the protocol uses proprietary tooling with no public advisory channel.
Notable historical examples
No hacks are currently linked in the database for this specific factor as a standalone causal driver. The factor is retained as P1 based on approximately two supporting instances in the T-01 evidence inventory and the growing supply-chain attack trend.
Measurement what to look for#
Determine whether any npm/PyPI/crates.io dependency of this protocol had a flagged malicious release in the trailing 90 days.